{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/f456/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-7081"}],"_cs_exploited":false,"_cs_products":["F456"],"_cs_severities":["critical"],"_cs_tags":["cve","buffer_overflow","router"],"_cs_type":"advisory","_cs_vendors":["Tenda"],"content_html":"\u003cp\u003eA critical buffer overflow vulnerability, identified as CVE-2026-7081, affects Tenda F456 router version 1.0.0.5. The vulnerability resides in the \u003ccode\u003efromGstDhcpSetSer\u003c/code\u003e function within the \u003ccode\u003e/goform/GstDhcpSetSer\u003c/code\u003e file, a component of the device\u0026rsquo;s httpd service. Successful exploitation allows a remote attacker to execute arbitrary code on the device. Publicly available exploit code increases the risk of widespread exploitation. This vulnerability poses a significant threat as it can lead to complete compromise of the affected device, potentially allowing attackers to gain unauthorized access to the network, steal sensitive information, or use the device as part of a botnet.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a vulnerable Tenda F456 router (version 1.0.0.5) exposed to the internet.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the \u003ccode\u003e/goform/GstDhcpSetSer\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe HTTP request includes the \u003ccode\u003edips\u003c/code\u003e argument, which is intentionally oversized to trigger the buffer overflow.\u003c/li\u003e\n\u003cli\u003eThe vulnerable \u003ccode\u003efromGstDhcpSetSer\u003c/code\u003e function processes the request without proper bounds checking.\u003c/li\u003e\n\u003cli\u003eThe oversized \u003ccode\u003edips\u003c/code\u003e argument overwrites adjacent memory regions on the stack.\u003c/li\u003e\n\u003cli\u003eThe attacker carefully crafts the overflow to overwrite the return address with an address pointing to attacker-controlled code.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efromGstDhcpSetSer\u003c/code\u003e function returns, causing execution to jump to the attacker\u0026rsquo;s code.\u003c/li\u003e\n\u003cli\u003eThe attacker\u0026rsquo;s code executes with the privileges of the httpd process, potentially leading to full device compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows a remote attacker to execute arbitrary code on the affected Tenda F456 router. This can result in complete device compromise, including the ability to modify device settings, intercept network traffic, and potentially use the compromised device as a pivot point for further attacks within the network. Given the widespread use of Tenda routers, a large number of devices could be vulnerable, making this a significant security concern.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests to \u003ccode\u003e/goform/GstDhcpSetSer\u003c/code\u003e with unusually long \u003ccode\u003edips\u003c/code\u003e parameter values to detect potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule \u003ccode\u003eDetect Tenda F456 Buffer Overflow Attempt\u003c/code\u003e to identify malicious HTTP requests.\u003c/li\u003e\n\u003cli\u003eSince no patch is available, consider replacing the affected Tenda F456 routers (version 1.0.0.5) with more secure alternatives.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-27T04:16:09Z","date_published":"2026-04-27T04:16:09Z","id":"/briefs/2026-04-tenda-f456-bo/","summary":"A buffer overflow vulnerability exists in Tenda F456 version 1.0.0.5 in the `fromGstDhcpSetSer` function, allowing remote attackers to execute arbitrary code by manipulating the 'dips' argument via a crafted HTTP request to `/goform/GstDhcpSetSer`.","title":"Tenda F456 Router Buffer Overflow Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-04-tenda-f456-bo/"},{"_cs_actors":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-7098"}],"_cs_exploited":false,"_cs_products":["F456"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-7098","buffer-overflow","router"],"_cs_type":"advisory","_cs_vendors":["Tenda"],"content_html":"\u003cp\u003eA critical buffer overflow vulnerability, identified as CVE-2026-7098, has been discovered in Tenda F456 router version 1.0.0.5. The vulnerability resides within the \u003ccode\u003efromDhcpListClient\u003c/code\u003e function of the \u003ccode\u003e/goform/DhcpListClient\u003c/code\u003e component\u0026rsquo;s \u003ccode\u003ehttpd\u003c/code\u003e service. An attacker can exploit this flaw by remotely manipulating the \u003ccode\u003epage\u003c/code\u003e argument, leading to a buffer overflow. Publicly available exploit code exists, increasing the risk of widespread exploitation. Successful exploitation could allow an attacker to execute arbitrary code on the device, potentially gaining full control of the router and the network it serves. This poses a significant threat to home and small business users relying on these routers.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a vulnerable Tenda F456 router (version 1.0.0.5) accessible over the network.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request targeting the \u003ccode\u003e/goform/DhcpListClient\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe crafted request includes a \u003ccode\u003epage\u003c/code\u003e argument with a payload designed to overflow the buffer in the \u003ccode\u003efromDhcpListClient\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ehttpd\u003c/code\u003e service processes the request and calls the \u003ccode\u003efromDhcpListClient\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eDue to insufficient bounds checking, the oversized payload overwrites the buffer, potentially overwriting adjacent memory regions.\u003c/li\u003e\n\u003cli\u003eThe attacker\u0026rsquo;s payload overwrites the return address on the stack with a pointer to attacker-controlled code.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efromDhcpListClient\u003c/code\u003e function returns, causing execution to jump to the attacker-controlled code.\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled code executes with the privileges of the \u003ccode\u003ehttpd\u003c/code\u003e service, potentially allowing for full control of the device.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability can allow a remote attacker to execute arbitrary code on the Tenda F456 router. This could lead to a complete compromise of the device, allowing the attacker to modify router settings, intercept network traffic, or use the router as a pivot point for further attacks within the network. Given the ease of exploitation and public availability of exploit code, a large number of Tenda F456 users are at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web server logs for suspicious requests to \u003ccode\u003e/goform/DhcpListClient\u003c/code\u003e with unusually long \u003ccode\u003epage\u003c/code\u003e parameters to detect potential exploitation attempts (see Sigma rule \u0026ldquo;Detect Tenda F456 Buffer Overflow Attempt\u0026rdquo;).\u003c/li\u003e\n\u003cli\u003eImplement rate limiting on requests to the \u003ccode\u003e/goform/DhcpListClient\u003c/code\u003e endpoint to mitigate the impact of potential attacks.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect Tenda F456 Buffer Overflow Response\u0026rdquo; to identify successful exploitation attempts based on server response codes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T12:00:00Z","date_published":"2024-01-02T12:00:00Z","id":"/briefs/2024-01-tenda-f456-buffer-overflow/","summary":"A remote buffer overflow vulnerability exists in Tenda F456 version 1.0.0.5 via manipulation of the 'page' argument in the fromDhcpListClient function of the /goform/DhcpListClient component, potentially leading to arbitrary code execution.","title":"Tenda F456 Remote Buffer Overflow Vulnerability","url":"https://feed.craftedsignal.io/briefs/2024-01-tenda-f456-buffer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed — F456","version":"https://jsonfeed.org/version/1.1"}